MalwareManufacturingRetail & ConsumerManufacturingInfostealerStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

STURM, RUGER & COMPANY, INC.

bd_38f04b97485bb418 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 2, 2022

Filed

Aug 17, 2022

To disclose

15 days

Affected

Not disclosed

Linked

11 filings

Confidence

64%

Full breach record for STURM, RUGER & COMPANY, INC. →

Sturm, Ruger & Company, Inc. notified customers of a data breach involving its third-party vendor, Freestyle Solutions, which hosted the ShopRuger.com website. Malware on the Freestyle server captured payment card information (card number, expiration date, security code) and basic identity data (name, address, email) from September 18, 2020, to February 3, 2022. Freestyle detected the malware and notified Ruger on August 2, 2022. Ruger offered identity theft protection services.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 2, 2022 → Notified Aug 18, 202216d ✓ CA 60-day OK15 days discovery → filing

Incident timeline

undetected · 683 days

discovery → filing · 15 days

Sep 18, 2020

Begins

Aug 2, 2022

Discovered

Aug 17, 2022

Filed

This filing is one of 11 filings about the same incident.View merged incident

Part of FreeStyle Solutions supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Delaware State AGbd_1f4061fbb0cfdce22022-08-17Verified
Maine State AGbd_9393cab4cdd552b62022-08-17Verified
Oregon State AGbd_ebaf2f767137b90a2022-08-17Verified
Montana State AGbd_f3f2fe6ea215d9fd2022-08-17Verified by operator

Show 6 more filings ↓up to 15d gap

Massachusetts State AGbd_2756ba599a1cd56c2022-08-18 · +1dVerified
Indiana State AGbd_4fae1ff48d4333632022-08-18 · +1dVerified
South Carolina State AGbd_9199d624bedf76d62022-08-18 · +1dVerified by operator
Washington State AGbd_ab208d75cc9435ea2022-08-18 · +1dVerified
New Hampshire State AGbd_424fddae629065202022-08-19 · +2dVerified
Delaware State AGbd_33d8926df2b3726e2022-08-02 · +15dVerified

Name: STURM, RUGER & COMPANY, INC.
norm: sturm ruger

Name: STURM, RUGER & COMPANY, INC.
norm: sturm ruger
Industry: ManufacturingllmRetail & Consumerllm

Discovered: Aug 2, 2022
Breach occurred: Sep 18, 2020 – Feb 3, 2022
Undetected for: 683 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 18, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Freestyle Solutions
Initial access: supply_chain

During the incident: Engaged Verizon to conduct an investigation and advise on further containment and remediation activities
Notified federal law enforcement authorities
Coordinating with payment card companies in an effort to protect affected cardholders
Offering identity theft protection services through IDX
Changes made: Removed malware from the server
Blocked known malicious users
Changed administrative passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 days(15 days from discovery to filing)
Compliance flags: CA 60-day OK · 16d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 2, 2022
→ Notified: Aug 18, 2022
16d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 2, 2022 → Notified: Aug 18, 2022	16d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Delaware State AGAug 2 · first

Delaware State AG+15d

Maine State AG+15d

Oregon State AG+15d

Montana State AG+15d

California State AG+15d · this page

Massachusetts State AG+16d

Indiana State AG+16d

South Carolina State AG+16d

Washington State AG+16d

New Hampshire State AG+17d

Pattern: first filing Aug 2 (DE), last Aug 19 (NH) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-556349
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2022
Raw hash: 6b86c83b14635db857c0dd347dfe2689cc6b0c57c78625f52189abb1fd34dbdb

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entitySTURM, RUGER & COMPANY, INC.

Victim entitySTURM, RUGER & COMPANY, INC.

Incidentdiscovered Aug 2, 2022

Stated responseEngaged Verizon to conduct an investigation and advise on further containment and remediation activities

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov